CVE-2013-4491 medium severity vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2013-4491 - Medium Vulnerability

⚠️ Vulnerable Library - actionpack-3.0.1.gem

path: /tmp/git/sample_app/Gemfile.lock

Dependency Hierarchy:

• factory_girl_rails-1.0.gem (Root Library)
  • rails-3.0.1.gem
    • actionmailer-3.0.1.gem
      • ❌ actionpack-3.0.1.gem (Vulnerable Library)

🔴 Vulnerability Details

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.

Publish Date: 2013-12-07

URL: CVE-2013-4491

🎯 CVSS 2 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: N/A
  • Attack Complexity: N/A
  • Privileges Required: N/A
  • User Interaction: N/A
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

---

Want to learn more about the open source vulnerabilities in your products? Click here